From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752790AbbHMJdJ (ORCPT ); Thu, 13 Aug 2015 05:33:09 -0400 Received: from mail-wi0-f170.google.com ([209.85.212.170]:37349 "EHLO mail-wi0-f170.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752752AbbHMJc7 (ORCPT ); Thu, 13 Aug 2015 05:32:59 -0400 From: David Drysdale To: linux-kernel@vger.kernel.org, Alexander Viro , Kees Cook , "Eric W. Biederman" Cc: Greg Kroah-Hartman , Meredydd Luff , Will Drewry , Jorge Lucangeli Obes , Ricky Zhou , Lee Campbell , Julien Tinnes , Mike Depinet , James Morris , Andy Lutomirski , Paolo Bonzini , Paul Moore , Christoph Hellwig , Michael Kerrisk , Dave Chinner , linux-api@vger.kernel.org, linux-arch@vger.kernel.org, linux-security-module@vger.kernel.org, linux-fsdevel@vger.kernel.org, fstests@vger.kernel.org, David Drysdale Subject: [PATCHv4 man-pages 3/3] open.2: describe O_BENEATH flag Date: Thu, 13 Aug 2015 10:32:46 +0100 Message-Id: <1439458366-8223-4-git-send-email-drysdale@google.com> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1439458366-8223-1-git-send-email-drysdale@google.com> References: <1439458366-8223-1-git-send-email-drysdale@google.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Signed-off-by: David Drysdale --- man2/open.2 | 44 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 44 insertions(+) diff --git a/man2/open.2 b/man2/open.2 index f49ab3042161..d09511f9ffb0 100644 --- a/man2/open.2 +++ b/man2/open.2 @@ -201,6 +201,43 @@ See for further details. See also BUGS, below. .TP +.B O_BENEATH " (since Linux 4.??)" +Ensure that the +.I pathname +is beneath the current working directory (for +.BR open (2)) +or the +.I dirfd +(for +.BR openat (2)). +If the +.I pathname +is absolute or contains a path component of "..", the +.BR open () +fails with the error +.BR EPERM. +This occurs even if ".." path component would not actually +escape the original directory; for example, a +.I pathname +of "subdir/../filename" would be rejected. +Path components that are symbolic links to absolute paths, or that are +relative paths containing a ".." component, will also cause the +.BR open () +operation to fail with the error +.BR EPERM. + +This feature allows applications to be sure that the opened file is +within the specified directory, regardless of the original source of the +.I pathname +argument. +Some security-conscious programs may further ensure +this by imposing a system call filter (with +.BR seccomp (2)) +that requires this flag for all +.BR open () +operations, so that the program cannot open files outside of +specified directories even if subverted. +.TP .BR O_CLOEXEC " (since Linux 2.6.23)" .\" NOTE! several other man pages refer to this text Enable the close-on-exec flag for the new file descriptor. @@ -1015,6 +1052,13 @@ did not match the owner of the file and the caller was not privileged The operation was prevented by a file seal; see .BR fcntl (2). .TP +.B EPERM +The +.B O_BENEATH +flag was specified and the +.I pathname +was not beneath the relevant directory. +.TP .B EROFS .I pathname refers to a file on a read-only filesystem and write access was -- 2.5.0.rc2.392.g76e840b